CVE-2024-40746 Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

What is CVE-2024-40746?

CVE-2024-40746 is a medium-severity cross-site scripting vulnerability in hikashop.com HikaShop component for Joomla, published on 21 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `description `parameter is not sanitised in the backend.

Weakness: CWE-79

Which versions are affected by CVE-2024-40746?

It affects 1 product.

Products include Hikashop Hikashop.

How do I fix CVE-2024-40746?

No fix has been published for CVE-2024-40746 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-40746 being exploited?

There is no known exploitation of CVE-2024-40746 in the wild and no public exploit code.

Other vulnerabilities in hikashop.com HikaShop component for Joomla

• CVE-2023-38044 Extension - hikashop.com - SQLi in HikaShop component for Joomla <= 4.7.2 Critical 9.8
• CVE-2025-22210 Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomla High 7.2
• CVE-2025-25225 Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla Medium 6.5
• CVE-2015-7344 Cross-site scripting in n/a Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-57xc-4245-hh9c.